Privacy Policy for TorahTone | Cibru

Privacy Policy — TorahTone ← Back to Legal Hub # Privacy Policy Last updated: October 20, 2026 TorahTone (“we”, “our”, or “the app”) is committed to protecting your privacy. This Privacy Policy explains what is processed on your device, what is sent to service providers, how subscriptions and optional referral rewards work, and the deletion choices available to you. ## 1. Information We Collect ### a) Account-free use and anonymous service identifiers No user-created login, name, or email is required for the current Android app. Its bundled web layer, including the Android WebView and web/PWA version, uses anonymous Firebase Authentication for cloud calls such as `getAudioUrl`. Optional referral sync creates a separate anonymous Supabase identity with access/refresh credentials. These are persistent service identifiers, not truly anonymous data or proof of your Google Play purchaser account. If you contact support, we receive your email and the information you choose to send. ### b) Location Data **Your location is used on-device.** If you enable the Shabbat Candle Lighting reminder feature, TorahTone requests approximate (coarse) location permission (`ACCESS_COARSE_LOCATION`) and calculates local sunset times on-device with SunCalc. The coordinates may be saved in the app’s local storage so reminders can be scheduled offline. TorahTone’s application code does not upload those coordinates to Firebase, Supabase, Google Play, or CIBRU. ### c) Firebase analytics, diagnostics, notifications, and storage Google Firebase services may process pseudonymous app activity and diagnostics, including: - App feature interactions (e.g., audio playback, quote preferences, notification toggles) - App performance and stability metrics (load times, error logs, crash traces) - General device specifications (OS version, device model, screen resolution, locale) - Anonymous Firebase Authentication identifiers used by cloud functions - Firebase installation identifiers, Cloud Messaging (FCM) registration tokens, and timezone-based topics such as `daily_quotes_p0530` for push routing - Audio paths, signed-URL requests, and ordinary connection information such as IP address for Firebase Storage and Cloud Functions - Firestore records used by callable functions, including rate-limit and legacy profile/subscription/trial records where those flows were used Analytics measures usage; Crashlytics reports crashes and diagnostics. They may process installation/session IDs and device/app details and are not limited to aggregate-only data. The current UI has no Analytics/Crashlytics opt-out toggle. FCM SDK registration may initialize independently of permission to display notifications; enabling daily reminders subscribes to a topic based on your UTC offset, and disabling them attempts to unsubscribe. Firebase App Check uses Play Integrity in native release builds; the web configuration can use reCAPTCHA when configured. Firebase `getAudioUrl` and legacy referral/subscription endpoints are separate from the current native Supabase verification service. The native purchase flow does not require a RevenueCat account; older Firebase subscription/deletion code still contains RevenueCat integration for legacy records. See Firebase privacy and security information. ### d) Google Play subscriptions and purchase verification Google Play Billing handles payment instruments, checkout, recurring charges, and order history. Reference offers are Weekly at US $0.99/week with no free trial; Monthly with an eligible 3-day free trial then US $1.99/month; and Annual with an eligible 7-day free trial then US $19.99/year. Google Play’s localized price and eligible offer govern. See Subscriptions & Refunds for trial conversion and cancellation. TorahTone does not receive your credit-card number or bank details. The native app sends a purchase token, product/app identifiers, request ID, and fresh Play Integrity token to the Supabase-hosted purchase service over HTTPS. The integrity proof binds the action, purchase token, product, and request ID. The service verifies the subscription through the Google Play Developer API, acknowledges eligible purchases, and manages verification/deletion records. A purchase token is a sensitive bearer credential; this design does not independently prove that a caller is the purchaser’s Google account. Only verified active entitlements unlock Premium; pending purchases do not. Authenticated local caches use server time and monotonic elapsed time for up to **72 hours for paid access** and **24 hours for referral VIP**, never beyond the entitlement’s expiry. Reboot, invalid cache, or paused/disabled sync invalidates offline access. An outage does not create a new entitlement. Local purchase tokens and referral credentials are protected using native cryptographic storage; if protection is unavailable, the implementation avoids persisting plaintext secrets. ### e) Google AdMob advertising For free-tier users, TorahTone integrates Google Mobile Ads (AdMob) to display advertisements. AdMob may automatically collect and process: - Google Advertising ID / AAID, app-set IDs, and other applicable SDK identifiers - Ad interaction data (ad impressions, clicks, views) - IP address (which can reveal approximate location), device/network details, and diagnostics for ad delivery, measurement, frequency capping, and fraud prevention Android advertising-ID and ad-privacy controls vary by OS version. An advertising-ID choice does not stop all SDK networking. Premium suppresses app ad presentation while valid, but the Mobile Ads SDK is initialized at app startup; Premium or referral unsync is not a global analytics/SDK opt-out. AdMob’s IP-derived location is separate from the candle-lighting coordinates, which TorahTone does not upload. See Google Mobile Ads data disclosure. ### f) Referral & VIP Rewards Program (optional, default-off) The Referral Program is **disabled by default**. Choosing to share while disabled opens the referral disclosure; registration/sync starts after you confirm opt-in: - **App-scoped device identifier:** native code reads `Settings.Secure.ANDROID_ID`, derives an app-scoped SHA-256 value, and truncates it to 16 hexadecimal characters for the shared contract. **Raw Android ID stays native** and is not passed to JavaScript or sent in referral requests. Supabase receives the derived value and HMACs it server-side for duplicate-install/fraud checks. This is pseudonymization, not anonymization. TorahTone does not request IMEI or MAC address. - **Install Referrer:** The Google Play Install Referrer API supplies the raw referral payload and install/click timestamps. These values are cached locally and sent to Supabase only to attribute a qualifying invite and prevent duplicate or automated credit. - **Play Integrity:** A request-bound integrity token is sent to Supabase so the backend can check that referral requests come from an eligible Google Play installation and an untampered package. - **Referral profile:** Supabase stores a pseudonymous profile/user ID, referral code, attribution/milestone count, and VIP expiry. Sharing gives the selected recipient/app your invite link containing the referral code. TorahTone does not upload a contacts list. ## 2. On-device and off-device data map **Processed only on your device:** approximate coordinates used for SunCalc, local preferences, notification schedules, quote history/cache, and local audio/subscription UI state. **Sent off-device when needed:** anonymous Firebase service identifiers and notification/diagnostic data; Google Play transaction processing; AdMob advertising signals for free-tier ads; and optional referral or purchase-verification data sent to Supabase. HTTPS/TLS is used for app network requests. ## 3. How We Use Your Information - **App Functionality:** To deliver ambient soundscapes, daily inspirational quotes, and local settings without requiring an account. - **Subscription Verification:** To grant and manage Premium feature access via Google Play Billing and server verification without collecting payment-card details. - **Referral Rewards & VIP Sync:** To track referral milestones, prevent duplicate reward abuse, and synchronize earned VIP time (only if you opt into the referral program). - **Notifications:** To deliver daily inspirational quote notifications and Shabbat reminders at your preferred local time. - **Astronomical Calculations:** To calculate Shabbat candle-lighting times locally on your device based on approximate coordinates. - **Ad Delivery:** To serve non-intrusive advertisements to users on the free tier via Google AdMob. - **App Performance & Security:** To detect crashes, improve responsiveness, secure Firebase/Supabase calls with App Check or Play Integrity, and prevent fraud. ## 4. Third-Party Services & Data Sharing The following providers receive data for the purposes listed. Advertising and analytics processing is distinct from the data necessary for billing and requested app features: - **Google Firebase:** Anonymous authentication for cloud calls, Cloud Messaging, Analytics, Crashlytics, App Check, Firestore service records, and Firebase Storage audio delivery. - **Google Play Store Billing (Google LLC):** Subscription verification, order fulfillment, and transaction processing. - **Google AdMob (Google Mobile Ads):** Serving in-app advertisements and ad measurement for free-tier users. - **Supabase:** Optional referral authentication/profile sync, Install Referrer attribution, referral milestone/VIP verification, and Google Play purchase verification/deletion endpoints. ### Android permissions, including SDK additions The merged Android manifest includes permissions contributed by dependencies as well as the app’s own manifest: - `INTERNET` and `ACCESS_NETWORK_STATE`: cloud requests, media downloads, billing, advertising, and connectivity checks. - `com.android.vending.BILLING`: Google Play subscriptions. - `POST_NOTIFICATIONS`, `com.google.android.c2dm.permission.RECEIVE`, and `RECEIVE_BOOT_COMPLETED`: push delivery and local notification scheduling/restoration. - `FOREGROUND_SERVICE`, `FOREGROUND_SERVICE_MEDIA_PLAYBACK`, and `WAKE_LOCK`: background audio playback and notification work. - `ACCESS_COARSE_LOCATION`: optional on-device sunset calculations; no fine/background location permission is declared in the inspected build. - `com.google.android.gms.permission.AD_ID`, `ACCESS_ADSERVICES_AD_ID`, `ACCESS_ADSERVICES_ATTRIBUTION`, and `ACCESS_ADSERVICES_TOPICS`: Google advertising/measurement SDK capabilities, subject to Android and provider controls. - `com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE`: Play install-attribution information. The app-scoped `DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION` protects internal receiver communication. A declared permission describes a capability, not proof that every feature uses it on every launch. The inspected manifest has no microphone, camera, contacts, calendar, or phone-state permission; TorahTone does not read keystrokes and plays supplied audio rather than recording you. ## 5. Data Storage, Security & Retention Local preferences, quotes, saved coordinates, and caches remain until replaced or cleared. Unsync clears local referral rewards/cache but retains referral authentication for later deletion. Purchase deletion retains available encrypted tokens if a request fails, so it can be retried. Clearing app storage or uninstalling removes local data, including the local sync-pause flag, but does not delete remote records or cancel Google Play billing. Network requests use HTTPS/TLS. Supabase records support verification, attribution, and security until deleted or otherwise expired under the service’s retention rules. Limited pseudonymous deletion markers (tombstones) may remain to prevent duplicate rewards or background events from recreating deleted records. This app cannot verify a live server purge schedule and does not promise an automatic 90-day purge. Firebase service retention and configured Analytics retention vary. Legacy Firebase trial-abuse records (email hash, UID, and trial-use time, where that older flow was used) are retained by the existing deletion function. Deleting a current Supabase record does not delete those Firebase records. Ask support for help identifying CIBRU-controlled records and any necessary retention; Google Play transaction records and providers’ own security records have separate retention requirements. ## 6. Your Rights & Choices The current app and these pages provide the following choices: - **Unsync referral:** open the Unsync page on your Android device and use its `torahtone://referral/unsync` link. The installed app stops referral sync and clears local reward/cache state while retaining authentication for a later deletion request. The web page does not delete remote rows. - **Remote referral deletion:** email support@cibru.in using the Data Deletion guide. There is no Settings referral-delete or unsync toggle in the current UI. - **Purchase verification deletion:** follow Purchase Data Deletion. The native operation persists a purchase-sync pause before deletion, disables paid access, cancels outstanding verification, and discards stale results. It targets only locally known tokens; errors keep sync paused and available encrypted tokens retained for retry. Only explicit **Restore Purchases** resumes that paused sync on the installation. It does not cancel Google Play billing or issue a refund. - **Reset Local App Data:** clear Android app storage, uninstall, or clear the web site’s browser data to remove local preferences/cache. This is separate from remote deletion. - **Notification Controls:** enable or disable **Settings → Daily Quote Reminders** and change Reminder Time; Android settings can also revoke notification permission. - **Location Permissions:** You can grant or revoke location permissions at any time via your device’s application settings. - **Ad Personalization:** You can opt out of personalized ads or reset your advertising identifier in your Android device settings. ## 7. Children’s Privacy TorahTone is not directed at children under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect or solicit personal information from children. If we become aware that personal information has been collected from a child without verified parental consent, we will promptly delete that data from our servers. ## 8. Google Play Data Safety Disclosure These disclosures describe the inspected app flows; the Play listing must also account for third-party SDK processing: - **Location:** candle-lighting coordinates stay local, but AdMob can infer approximate location from IP address. - **Off-device data:** purchase tokens, pseudonymous service/device identifiers, FCM tokens and timezone topics, diagnostics/analytics events, and optional derived referral identifiers/Install Referrer data. - **Support and legacy accounts:** names/email addresses may be received if you email support or use the separate legacy Google-sign-in deletion page. A Google password is never requested by TorahTone. - **Official Listing:** TorahTone on Google Play ## 9. Data Deletion Policy TorahTone separates local data, referral data, and purchase-verification data so that one request does not silently delete another category: ### Option A: Referral Data Deletion Request removal of your TorahTone Supabase referral profile/rewards through support. Keep the referral code if available to help identify the record; do not email session tokens or raw device identifiers. Unsync alone is reversible, retains the remote profile and local authentication, and does not delete server data or cancel paid subscriptions. ### Option B: Purchase Verification Data Deletion In Android, use **Settings → Subscription → Delete Purchase Data** and confirm the warning to start the native deletion request. Use the Purchase Data Deletion guide for the support route and native-operation limits. Only server-confirmed deletion is reported as successful. Missing local records are not treated as successful server deletion. Opening a guide or emailing support does not itself change the installed app’s pause flag. Restoring purchases can send purchase data again but does not buy a new plan. ### Option C: Email Request You may also submit a deletion request via email to CIBRU support at support@cibru.in with the subject line *“TorahTone Data Deletion Request”*. We will verify the request, explain any records controlled by Google or another provider, and process CIBRU-controlled records within the period required by applicable law. ## 10. Privacy Rights and International Processing Depending on the law that applies to you, you may request access, correction, deletion, portability, restriction, or objection to processing, withdraw applicable consent, and complain to a supervisory authority. Contact CIBRU at support@cibru.in; verification and legally required retention may limit a request. Requested functionality and purchases, security/abuse prevention, legal obligations, and consent where required are the purposes/bases relevant to processing. This page does not create an in-app consent control that the app does not offer. Google/Firebase and Supabase may process data outside your country. Locations depend on the service and project configuration; they are not all confined to one country. Refer to the providers’ privacy and data-processing terms, including Supabase’s Privacy Policy, or contact support for project-specific information. ## 11. Changes to This Privacy Policy We may update this Privacy Policy periodically to reflect app updates, new features, or evolving legal requirements. Any modifications will be posted on this page with an updated “Last updated” date. We encourage you to review this policy periodically. ## 12. Contact Us If you have any questions, concerns, or privacy requests regarding this Privacy Policy or our data practices, please contact CIBRU at: **Operator:** CIBRU, operated by Krishna moni Borah **Address:** Kakojan, Jorhat, Assam - 785107, India **Email:** support@cibru.in Legal Hub · **Privacy Policy** · Terms of Service · Refund Policy · Purchase Data Deletion · Data Deletion

Privacy Policy. Respect for your autonomy.

Have questions about your personal data?